If you host a website and are worried about these types of attacks against your users, there are a couple of fairly straightforward things you can do to strengt

If you host a website and are worried about these types of attacks against your users, there are a couple of fairly straightforward things you can do to strengthen your position: 1) There is no reason that your mobile apps need to use the public CA system. You can either generate your own signing certificates and embed them in your apps, or if you must use CA certificates for your mobile endpoints, at least pin those SPKIs in your apps. More info here: http://www.thoughtcrime.org/blog/authenticity-is-broken-in-ssl-but-your-app-ha/ http://www.thoughtcrime.org/blog/authenticity-is-broken-in-s... 2) If your website is high volume, Adam Langley is very generous about adding certificate pins for the CA you are using to Chrome: http://www.imperialviolet.org/2011/05/04/pinning.html http://www.imperialviolet.org/2011/05/04/pinning.html This will mean that a random CA in Turkey can not be used to intercept traffic to your website from Chrome, in the exact same was that Google was protected in this incident with its own websites. Word on the street is that Firefox is now beginning to use the same list of pins. 3) Experiment with and support the development of TACK, which is a way to frictionlessly pin certificates for your website in a dynamic way (rather than having to hardcode them into browser binaries): http://tack.io http://tack.io 4) And of course, make sure that you're advertising HSTS headers, so that your users aren't vulnerable to sslstrip (http://www.thoughtcrime.org/software/sslstrip http://www.thoughtcrime.org/software/sslstrip) attacks.